A defense-in-depth bundle for hardening an agentic Claude Code workstation: block secrets and sensitive data before they are written, verify dependency provenance and known vulnerabilities, review supply-chain risk and run code security audits, and harden MCP tool access against prompt injection.
Open the source and read safety notes before installing.
Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.
Decision playbook
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
0
78
—
No baseline selected
No major trust-signal divergence detected in the current selection.
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Source provenance statusRequired
Marked as source-backed.
Metadata reviewed
Registry metadata indicates a reviewed listing.
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Trust level risk gateRequired
Trust level does not block evaluation.
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Package verification flag
No package verification flag provided.
Checksum metadata
No checksum provided for downloaded artifact.
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
Baseline comparison available
No baseline peer selected yet.
Diverging trust signals identified
No major trust-signal divergence found.
Setup at a glance
Copy-ready — paste the snippet to get started.
Adoption plan
Current risk score 16/100. Use staged verification before broader rollout.
Validate source and review signals before any execution.
Confirm source provenanceRequired
Source URL/provenance metadata is present.
Confirm metadata review state
Listing has review metadata.
Verify install payload
Install/config payload exists and can be inspected.
Confirm safety, privacy, and package integrity signals.
Review safety notesRequired
Safety notes are present.
Review privacy notesRequired
Privacy notes are present.
Verify package integrity metadata
No package verification/checksum metadata.
Adopt in controlled steps based on the selected plan.
Run in isolated sandbox firstRequired
Use a constrained sandbox and observe behavior across multiple tasks.
Roll out graduallyRequired
Roll out to a small cohort before wider usage.
Set monitoring and fallback
Define rollback path and monitor errors after adoption.
Evidence readiness
Required evidence gates are covered (5/6 signals complete).
Source repository/provenance is listed.
Required in this preset
Review metadata is present.
Required in this preset
Safety notes are present.
Required in this preset
Privacy notes are present.
Optional in this preset
Package integrity metadata is missing.
Optional in this preset
Install payload is available.
Required in this preset
Required evidence gates are covered for this preset.
Decision timeline
5/6 steps complete with no blocking gaps for this preset.
triage
Source/provenance metadata is available.
triage
Review metadata is available.
verify
Safety notes are available.
verify
Privacy notes are available.
verify
Package integrity metadata is missing.
rollout
Install payload is available.
No required blockers for this timeline preset.
Prerequisite readiness
2 prerequisites to line up before setup.
Safety & privacy surface
1 safety and 1 privacy notes across 2 risk areas. Review closely: network access.
## What this collection sets up
A layered, defense-in-depth setup for an agentic Claude Code workstation, organized around the practices in the [NIST Secure Software Development Framework (SSDF)](https://csrc.nist.gov/projects/ssdf). Each layer is an existing, source-backed directory entry; together they cover the main ways an agent session can leak secrets, pull untrusted code, or be steered by malicious content.
## Layers
### 1. Write-time guards (SSDF PW — protect the code)
- **pre-write-secret-scanner** (hook) — blocks a write whose content matches a high-confidence secret format before it reaches disk.
- **sensitive-data-alert-scanner** (hook) — flags sensitive data in content being produced.
### 2. Dependency and supply-chain (SSDF PS — protect the software)
- **lockfile-provenance-checker** (hook) — flags npm lockfile entries resolved from outside the public registry or missing an integrity hash.
- **package-vulnerability-scanner** (hook) — scans dependency changes for known vulnerabilities.
- **dependency-risk-review** (command) — reviews supply-chain posture with OpenSSF Scorecard health signals.
### 3. Audit and policy (SSDF RV — respond to vulnerabilities)
- **security-audit** (command) — runs an on-demand code security audit.
- **security-auditor** (rules) — keeps the assistant in a security-first, adversarial mindset.
### 4. MCP and prompt-injection hardening
- **mcp-server-security-hardening** (skill) — hardens MCP tool/server access.
- **prompt-injection-defense-guardrails** (skill) — defends against instructions injected through retrieved content.
## Suggested order
Install the write-time guards first so secrets and sensitive data are stopped at the source, then add the supply-chain checks, then the audit command and policy rules, and finally the MCP and prompt-injection hardening skills. See `installationOrder` for the exact sequence.
## Notes
Each entry carries its own prerequisites, safety notes, and privacy notes — read them before enabling a hook that blocks writes or a command that runs audits in your environment.
## Source and references
- NIST Secure Software Development Framework: https://csrc.nist.gov/projects/ssdf
- OpenSSF security best practices: https://best.openssf.org/
- Claude Code hooks documentation: https://docs.anthropic.com/en/docs/claude-code/hooksA layered, defense-in-depth setup for an agentic Claude Code workstation, organized around the practices in the NIST Secure Software Development Framework (SSDF). Each layer is an existing, source-backed directory entry; together they cover the main ways an agent session can leak secrets, pull untrusted code, or be steered by malicious content.
Install the write-time guards first so secrets and sensitive data are stopped at the source, then add the supply-chain checks, then the audit command and policy rules, and finally the MCP and prompt-injection hardening skills. See installationOrder for the exact sequence.
Each entry carries its own prerequisites, safety notes, and privacy notes — read them before enabling a hook that blocks writes or a command that runs audits in your environment.
Show that Secure Claude Code Workstation is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/collections/secure-claude-code-workstation)Secure Claude Code Workstation side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
1 trust signal differ across this comparison (Submitter).
Next steps differ across entries — use the actions in the table below to copy install commands and source links per resource.
| Field | A defense-in-depth bundle for hardening an agentic Claude Code workstation: block secrets and sensitive data before they are written, verify dependency provenance and known vulnerabilities, review supply-chain risk and run code security audits, and harden MCP tool access against prompt injection. Open dossier | Slash command that reviews the supply-chain risk of a project's dependencies using OpenSSF Scorecard health signals rather than CVE counts. Open dossier | PostToolUse hook that inspects an edited npm package-lock.json for supply-chain provenance risk rather than known CVEs — dependencies resolved from outside the public npm registry (git, alternate-registry, or insecure transports) and registry tarballs missing an integrity hash. Open dossier | PreToolUse hook that scans the exact text Claude Code is about to write or edit for high-confidence secret formats (AWS access keys, GitHub tokens, OpenAI keys, Slack tokens, Google API keys, Stripe keys, and private key blocks) and blocks the write with a non-zero exit before the secret ever reaches disk. Open dossier |
|---|---|---|---|---|
| Next stepsDiffers | ||||
| Trust | ||||
| Review status | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed |
| Package trust | Package not verified | Package not verified | Package not verified | Package not verified |
| Source provenance | Source-backed | Source-backed | Source-backed | Source-backed |
| SubmitterDiffers | techforgeworks | techforgeworks | techforgeworks | jony376 |
| Install risk | Review first | Review first | Review first | Review first |
| Notes | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ |
| Brand | — | — | — | — |
| Category | collections | commands | hooks | hooks |
| Source | Source-backed | Source-backed | Source-backed | Source-backed |
| Author | techforgeworks | techforgeworks | techforgeworks | jony376 |
| Added | 2026-06-04 | 2026-06-04 | 2026-06-04 | 2026-06-04 |
| Platforms | ||||
| Harness | ||||
| Source repo | — | — | — | — |
| Safety notes | ✓This is a curated index of existing directory entries; the collection runs nothing itself - review each linked hook, command, rule, and skill's own safety notes before installing it. | ✓Queries the public OpenSSF Scorecard API and OSV API with read-only GET requests to look up already-published health scores and advisories; it changes nothing in your project or in any dependency. When the optional scorecard CLI is used to score a repository that is not already in the public dataset, it performs read-only analysis and needs a GitHub token; it never modifies repositories. The review is advisory - it ranks risk and recommends actions, but it does not pin, update, remove, or vendor any dependency on its own. | ✓Runs after every Write, Edit, and MultiEdit and inspects only npm package-lock.json or npm-shrinkwrap.json content; for yarn.lock and pnpm-lock.yaml it prints a one-line reminder to run lockfile-lint. Read-only and advisory - it parses the lockfile JSON, never installs packages, runs npm, or makes a network call, and always exits 0. Uses the resolved-URL and integrity fields to flag provenance risk (sources outside the public registry, missing integrity); it does not assess known vulnerabilities, so pair it with an audit tool. | ✓Runs before every Write, Edit, and MultiEdit and reads the pending content from the tool input on stdin. Blocks the write with exit code 2 when a high-confidence secret pattern matches; no files are created, deleted, or modified by the hook itself. Uses regex heuristics, so it can produce false positives (block a non-secret) or false negatives (miss an obfuscated secret); treat it as a guardrail, not proof of safety. Makes no network calls and runs entirely locally. Safe for user-level settings only when the command points to a trusted script you installed under your home directory; do not configure global hooks to execute scripts from `$CLAUDE_PROJECT_DIR`. |
| Privacy notes | ✓The collection handles no data on its own; consult each linked entry's privacy notes for its runtime behavior and any local or network access. | ✓External lookups can expose dependency names, versions, scoped package names, and repo identifiers to public Scorecard and OSV APIs; skip private/internal packages and private repos unless the user explicitly approves sharing that metadata. Scorecard and OSV responses (numeric check scores and advisory text) enter the model context to explain the risk ranking. It writes nothing to disk beyond any output you choose to redirect. | ✓Reads only the local lockfile from disk; it makes no network or registry calls. Prints dependency paths and their resolved URLs to local hook stderr; it writes no logs. Resolved URLs shown in output may include internal registry or git host names if your project depends on them. | ✓Reads the text about to be written but never prints the matched secret value; only the detected secret type and the target file path are written to stderr. Writes nothing to disk and retains no logs. The target file path shown in the message may reveal local directory structure in your terminal output. |
| Prerequisites |
| — none listed |
|
|
| Install | — | | | |
| Config | — | — | | |
| Citations | ||||
| Claim | Unclaimed | Unclaimed | Unclaimed | Unclaimed |
Source-backed guides for putting this to work.
Verify MCP package provenance and publisher trust before adding servers to Claude Code.
Loading live community signals…
A short, calm digest of reviewed Claude resources. Unsubscribe any time.